I am not a security expert, and unfortunately we are too small company to have one. Since I am in charge of completing PCI DSS self-assessment questionnaires, I was shocked with the amount of questions specified.

First couple of questions are about firewall, network topology, routers etc, etc. Since we are an e-commerce and we host our web server on a remote location, I would really like to know are those questions regarding our web server or our office location.

Since we do not store or process any credit card information at our office location, we have chosen SAQ A -EP. but I am still not sure which network this questionnaire addresses?

If they are meant for our web server, how can I know all these network settings from a third party hosting. I contacted them (large hosting company) and they explained they did not have similar request.

Now I am confused did I got this process all wrong?

1 Answer 1


The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

You are required to use a PCI-compliant 3rd party as outlined in the "Before You Begin" section of the standard (page iii).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .